5ff1312ff294988804eb0f6fd284e65ba7496a06cae5f9acd8b5096cfbe3683f

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 02:05

Target

01e8d7c61dc27d749ca99dd9a1ed6a9b_JaffaCakes118.dll
Size

71KB
MD5

01e8d7c61dc27d749ca99dd9a1ed6a9b
SHA1

3841dabc9d6985edef85465c7eaec73f4816fdab
SHA256

5ff1312ff294988804eb0f6fd284e65ba7496a06cae5f9acd8b5096cfbe3683f
SHA512

72e78c7b3ee8518542ceb496e141052ec633557063937e4ca08c4ab350c2d921b13d6c1aef47ceacd9db529ddd5da362910e5144a1e9f669e85a08c8ff356e6f
SSDEEP

1536:Z6yEOWXF+/A8kvOZf1EgV+ck8GoHSQ2wk5RngBRP0jnW9JlCK72YKHt:Qc37MOZfdVNk86Q2LTnsRsbYJEKaxHt

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5052-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 5052	5080	rundll32.exe	81
PID 5080 wrote to memory of 5052	5080	rundll32.exe	81
PID 5080 wrote to memory of 5052	5080	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01e8d7c61dc27d749ca99dd9a1ed6a9b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01e8d7c61dc27d749ca99dd9a1ed6a9b_JaffaCakes118.dll,#1
  2⤵
  PID:5052

memory/5052-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download